Stealing secrets from developers using WebSockets
1–10 of 146 posts
Re: Stealing secrets from developers using WebSockets
#2This is interesting, thanks for sharing. I wonder if a remediation for the moment would be for local websocket servers to check the Host header before sending the 101 switch protocol response. Also would a CORS "Access-Control-Allow-Origin: localhost" prevent the connections being established?
Re: Stealing secrets from developers using WebSockets
#3This is interesting, thanks for sharing. I wonder if a remediation for the moment would be for local websocket servers to check the Host header before sending the 101 switch protocol response. Also would a CORS "Access-Control-Allow-Origin: localhost" prevent the connections being established?
The Host fix sounds right to me, local TCP web servers already have to do the same thing to avoid DNS rebinding attacks from external websites.
Re: Stealing secrets from developers using WebSockets
#4Why the actual fuck will a browser allow traffic to localhost from anywhere else?
Re: Stealing secrets from developers using WebSockets
#5The server didn't work for me, not sure if it's a traffic issue or what.
I have at least 3 create-react-app and one next app running. I even ran a quick websocket server on port 3000 just to see but nada.
Re: Stealing secrets from developers using WebSockets
#6Why the actual fuck will a browser allow traffic to localhost from anywhere else?
Super bad news about that: even if it didn't allow the `localhost` string, DNS rebinding allows the domain name of the site you visited to become 127.0.0.1.
The answer to why browsers allow connections to 127.0.0.1 from external sites is probably something like "legacy reasons".
Re: Stealing secrets from developers using WebSockets
#7Why the actual fuck will a browser allow traffic to localhost from anywhere else?
Super bad news about that: even if it didn't allow the `localhost` string, DNS rebinding allows the domain name of the site you visited to become 127.0.0.1. The answer to why browsers allow connections to 127.0.0.1 from external sites is probably something like "legacy reasons".
DNS rebinding can be fixed at the DNS server level. OpenWRT has an option for it.
But this websocket thing in browsers can't easily be turned off/mitigated AFAICT.
Re: Stealing secrets from developers using WebSockets
#8Earlier quoted context omitted.
Super bad news about that: even if it didn't allow the `localhost` string, DNS rebinding allows the domain name of the site you visited to become 127.0.0.1. The answer to why browsers allow connections to 127.0.0.1 from external sites is probably something like "legacy reasons".
DNS rebinding can be fixed at the DNS server level. OpenWRT has an option for it. But this websocket thing in browsers can't easily be turned off/mitigated AFAICT.
Well if you are going to use custom software to alter how protocols work, you could just change your web browser.
Re: Stealing secrets from developers using WebSockets
#9This is interesting, thanks for sharing. I wonder if a remediation for the moment would be for local websocket servers to check the Host header before sending the 101 switch protocol response. Also would a CORS "Access-Control-Allow-Origin: localhost" prevent the connections being established?
> Also would a CORS "Access-Control-Allow-Origin: localhost" prevent the connections being established?
WebSocket isn't bound by CORS, AFAIK.
Re: Stealing secrets from developers using WebSockets
#10[deleted]